When staff bypass security, AI can spot it fast

A NSW audit found something most security leaders recognise instantly: when controls slow down the work, people route around them. Clinicians in multiple local health districts reportedly saved patient data to personal devices, stayed logged into shared computers, and used insecure channels like email or fax because “clinical urgency” came first.

If you’re in banking or fintech, don’t file this under “healthcare problems.” The pattern is identical in financial services—just with different stakes: payment fraud, account takeover, insider risk, and regulatory exposure. The uncomfortable truth is that policy doesn’t beat workflow. Workflow wins every day.

This is where the “AI in Finance and FinTech” conversation gets real. AI isn’t only about fraud models and credit scoring. It’s also about detecting control bypasses in real time—the moments when human behaviour quietly creates the next breach.

Control bypasses happen for predictable reasons

Control bypasses aren’t random acts of negligence. They’re usually a rational response to friction.

In the NSW audit, the drivers were clear: shared workstations, frequent context switching, slow systems, and complex passwords. The result was “normalisation of non-compliance”—a culture where bypassing security becomes a practical norm.

Finance has its own versions of “clinical urgency”:

• A call-centre agent trying to hit handle-time targets
• An ops analyst racing to reconcile end-of-day exceptions
• A relationship manager sharing documents from a phone between meetings
• A developer pushing a hotfix minutes before a market open

The core failure: controls that don’t respect time

When authentication takes too long, people stop logging out. When secure file transfer is clunky, people email attachments. When device management blocks legitimate tools, people use personal devices.

Security teams often interpret this as “lack of awareness.” I don’t. Most of the time it’s misaligned incentives:

• The business rewards speed and throughput.
• Security measures introduce latency and extra steps.
• Staff optimise for what they’re measured on.

If you want fewer bypasses, you don’t start with posters and training videos. You start by fixing the workflow.

Why this matters more in 2026: AI increases both speed and blast radius

Financial institutions are adding AI across the stack: customer service copilots, automated underwriting, AML triage, fraud detection, and even internal code assistants.

That’s progress—but it changes the security equation:

• More systems: AI services often add new vendors, APIs, model endpoints, and data pipelines.
• More data movement: prompts, embeddings, and logs can carry sensitive data.
• More privileged access: AI agents and automation routinely need broad permissions to be useful.

So the old bypass problem gets sharper: one “small” workaround can expose far more.

A single example: if staff paste customer data into an unapproved AI tool “just to summarise a case,” you’ve now got data leakage plus a potential compliance issue. The behaviour looks minor. The impact isn’t.

Finance already operates under breach-heavy conditions

The audit referenced federal reporting that the health sector consistently experiences the most data breaches in Australia, based on notifiable breach statistics for the first half of 2025.

Finance isn’t far behind in terms of adversary attention. Banks and fintechs face constant credential stuffing, social engineering, and targeted fraud. The difference is that finance often has stronger control frameworks—yet human workarounds still slip through.

Where AI-powered monitoring actually helps (and where it doesn’t)

AI won’t magically make staff comply. What it can do is detect behaviour patterns that indicate control failure—and do it early enough to prevent an incident.

Think of it as the security equivalent of transaction fraud detection:

• Fraud systems don’t assume customers behave perfectly.
• They assume anomalies happen—and watch for them.

Security needs the same mindset about employees and contractors.

1) Detect “shadow channels” and risky data movement

In the NSW audit, clinicians used personal devices and unsecured apps. In finance, common equivalents include:

• Sensitive files moving to personal cloud storage
• Attachments sent externally “for convenience”
• Screenshots and exports from core systems
• Data copied from secure tools into chat apps

AI helps by correlating weak signals across tools: endpoint activity, DLP events, email metadata, identity logs, and SaaS sharing permissions.

What works in practice:

• Entity behaviour analytics that flags unusual download volumes, repeated export actions, or off-hours access
• NLP-based classification to identify sensitive content in emails/attachments (without relying solely on rigid regex rules)
• Risk scoring that escalates repeated borderline behaviour—because “one-off” often becomes habit

2) Catch “stay logged in” risk with identity and session analytics

The audit noted staff remaining logged in on unattended machines because logging in/out was too disruptive.

In banking environments—especially branches, contact centres, and operations floors—session misuse is a real risk. AI-powered identity analytics can detect:

• Impossible travel and unusual geo patterns
• Concurrent sessions across devices that don’t make sense for a role
• Long-lived sessions on shared endpoints
• Privileged actions performed outside normal cadence

A strong stance: session risk is under-instrumented in many fintechs. Lots of teams focus on MFA at login, but they don’t measure session integrity over time.

3) Reduce false positives so humans can respond faster

Security teams lose the plot when alert queues become unmanageable. If everything is “critical,” nothing is.

AI can improve triage by:

• Deduplicating related events into one incident narrative
• Prioritising alerts based on role, asset criticality, and data sensitivity
• Learning what “normal” looks like per team (not just per company)

This matters because the NSW audit also highlighted lean resourcing: many districts reportedly had about one full-time equivalent dedicated to cyber security.

Fintech teams aren’t always much better off. A small security function needs automation that truly saves time—not automation that creates extra tooling overhead.

The governance gap: plans, response, and “crown jewels” don’t maintain themselves

The audit found that the reviewed districts lacked effective cyber security plans, response plans, and continuity planning that considered cyber risks. It also noted inconsistent monitoring across “crown jewel” systems.

Finance has a similar failure mode: organisations know their high-value assets in theory (core banking, payment rails, identity providers, data lakes), but they don’t consistently treat them as such day-to-day.

A practical “crown jewels” checklist for banks and fintechs

If you want AI-powered monitoring to matter, define what matters first.

1. List your crown jewels as systems + data flows (not just system names). Include where data is exported, reported, and cached.
2. Tag identity roles that touch them (service accounts, admins, operations roles, vendor access).
3. Set monitoring parity: the same baseline logging, alerting, and retention across all crown jewels.
4. Test response with realistic bypass scenarios:
   • “Agent emails a spreadsheet to personal Gmail”
   • “Contractor exports a customer list from CRM”
   • “Ops user runs bulk downloads at 2am”
5. Measure friction: time-to-login, time-to-access key tools, and how often staff re-authenticate per hour. If you don’t measure it, you’ll misdiagnose it.

A blunt rule: if the secure path is slower than the insecure path, your controls are already failing.

How to prevent bypasses: make the right thing the easy thing

Detection is necessary, but prevention is cheaper.

Design controls around real workflows

Start with the highest-friction moments:

• Re-authentication loops during customer calls
• Switching between multiple core systems
• Accessing secure documents from mobile devices
• Sharing information with external counterparties (brokers, partners, merchants)

Then do the unglamorous fixes:

• SSO done properly (including legacy apps where possible)
• Phishing-resistant MFA for high-risk roles
• Password policy sanity (length matters; constant complexity changes don’t)
• Fast, approved secure sharing that beats email attachments on speed
• Managed mobile options for roles that genuinely need mobility

Use AI for guardrails, not surveillance theatre

Employees don’t want “big brother,” and regulators won’t accept vague assurances.

Good AI monitoring is:

• Transparent about what it measures (events, not personal content)
• Focused on risk outcomes (data movement, privileged actions)
• Paired with clear escalation paths and human review

Bad AI monitoring is:

• A black box that can’t explain why it flagged someone
• Tuned so aggressively it punishes normal work
• Used as a substitute for fixing workflow friction

A quick Q&A fintech leaders are asking right now

Can AI replace security controls?

No. AI improves detection and response, but it doesn’t replace baseline controls like least privilege, strong identity, logging, and secure configuration.

Where should a fintech start if budget is tight?

Start where you’ll see bypass behaviour first:

• Identity and access logs (SSO/IdP)
• Endpoint visibility for staff handling sensitive data
• Email and SaaS sharing controls

Then add AI-driven correlation to reduce alert fatigue.

How do we prove impact to the business?

Track metrics that map to risk and productivity:

• Mean time to detect and respond (MTTD/MTTR)
• Number of repeat bypass patterns reduced over 90 days
• Reduction in sensitive data leaving approved systems
• Time saved per analyst per week via incident clustering

What the NSW Health audit should change in finance conversations

The most useful lesson from the NSW report isn’t “people break rules.” It’s that organisations create the conditions where breaking rules feels necessary.

Banks and fintechs are betting heavily on AI—fraud detection, AML automation, personalised finance, and faster decisions. That only works if the underlying security posture can keep up with human behaviour at scale.

If you’re rolling out AI across customer operations or risk teams in 2026, bake this into the program: instrument bypass patterns, reduce friction where it happens, and use AI to surface anomalies early—before they become incidents.

If your team wants a practical starting point, begin by mapping your “crown jewel” systems, then identify the top five workflow frictions that cause staff workarounds. Fix two of them in Q1. Add behavioural monitoring that tells you whether the workarounds truly stopped.

What’s the bypass you suspect is happening in your organisation right now—but you can’t yet measure confidently?